Editing Pandora
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 1: | Line 1: | ||
On August 22 2007, Team C+D released the "Pandora's Battery" which was the [[Prometheus]] Project everyone was waiting for. It converted a spare Memory Stick Pro Duo and | On August 22 2007, Team C+D released the "Pandora's Battery" which was the [[Prometheus]] Project everyone was waiting for. It converted a spare Memory Stick Pro Duo and battery into a "Magic Memory Stick" and "JigKick Battery". Some People mistake Pandora's Battery for the Jigkick Battery, but Pandora's battery is both the Magic Memory Stick and the JigKick Battery. The Memory Stick and battery can then be used to downgrade any PSP of any version or to recover from a brick. To convert the Memory Stick and battery another PSP which is able to run 1.50 homebrew is needed. The Memory Stick can also be converted without using a homebrew PSP by using a Pandora's battery program, such as Pandora Easy GUI. After the downgrade/unbrick service has been completed, the Memory Stick and battery can be restored for normal usage. | ||
= [[JigKick Battery]] = | |||
This is a battery with its serial changed to 0xFFFFFFFF. When a psp's battery serial number is changed to 0xFFFFFFFF the PSP boots the ipl from sector 16 on the physical drive (the Magic Memory Stick). This unlocks the service mode of the PSP and launches the IPL from the Memory Stick (instead of from flash0). You can either Hardmod a battery or Softmod it. | |||
Hardmod is when you you make a JigKick Battery by opening it up and and removing a pin, this can be done to any battery. | |||
Softmod is when you make a JigKick Battery by using a program. But it has to be suitable. New Batteries cannot be softmodded. | |||
Click here to find out more! | |||
= [[Magic Memory Stick]] = | |||
A Magic Memory Stick refers to any memory stick that has been converted to boot, and work with a JigKick Battery. Depending on the method of creation, a Magic Memory Stick can either downgrade or boot PSPs to 1.50 FW (Phat), upgrade any PSP to 3.71/3.80 M33, and their counterparts, or be able to launch various homebrew. But it has to be suitable. The Memory sticks can be made into Magic Memory Sticks only if they are Pro Duo, and below 4GB. | |||
= In-depth Technological Details = | |||
The fake encrypted data is bruteforced to decrypt into your chosen data (to be able to exploit the preipl). And the signature for your fake encrypted data is bruteforced again to make it appear valid in the eyes of the crypto engine so that it will will go ahead and decrypt your fake encrypted data. | |||
The | The preipl exploit works like this: | ||
<source lang="xml"> | |||
First a decrypted ipl block: | |||
First a decrypted | |||
0x00: load address | 0x00: load address | ||
0x04: data size | 0x04: data size | ||
| Line 86: | Line 36: | ||
0xB71C6EBA | 0xB71C6EBA | ||
...data... | ...data... | ||
</ | </source> | ||
Which means load 0xF50-byte data to 0x040F1EA0. 0xB71C6EBA is the checksum of the previous block. Then entry address is 0 since it | Which means load 0xF50-byte data to 0x040F1EA0. 0xB71C6EBA is the checksum of the previous block. Then entry address is 0 since it hasnt reached the end yet and there are more blocks to load. Once it has loaded all the ipl blocks the very last block will have entry address of where the whole ipl has been loaded (typically 0x040F0000). And will then jump to that address. | ||
Preipl pseudocode for loading & decrypting the ipl: | |||
Code: | |||
< | <source lang="xml"> | ||
int iplBlockNumber = 0; | int iplBlockNumber = 0; | ||
u32 checksum = 0; | u32 checksum = 0; | ||
| Line 128: | Line 78: | ||
iplBlockNumber++; | iplBlockNumber++; | ||
} | } | ||
As the | </source> | ||
As the preipl loads the first ipl block (the fake one), it decrypts the block in-place, ie. the decrypted block just overwrites your encrypted block. The fake block only decrypts into four bytes of all 0's so it ends up only overwriting the first four bytes of your fake block (with four 0's) after decryption. | |||
The fake signed block: | The fake signed block: | ||
< | <source lang="xml"> | ||
Code: | Code: | ||
00000000: 00 00 00 00 00 00 00 00 00 01 D0 BF 00 00 00 00 | 00000000: 00 00 00 00 00 00 00 00 00 01 D0 BF 00 00 00 00 | ||
| Line 147: | Line 98: | ||
00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
000000A0: 00 00 00 00 00 00 00 00 00 00 00 01 C6 5F 74 12 | 000000A0: 00 00 00 00 00 00 00 00 00 00 00 01 C6 5F 74 12 | ||
</ | </source> | ||
The most important parts to note: | The most important parts to note: | ||
| Line 154: | Line 106: | ||
0x70-0x73 is the size of the decrypted data (only 4 bytes) | 0x70-0x73 is the size of the decrypted data (only 4 bytes) | ||
A slight flaw in the crypto engine allowed bruteforce to be performed on a magnitude-times smaller scale than normally required | A slight flaw in the crypto engine allowed the bruteforce to be performed on a magnitude-times smaller scale than normally required. | ||
After decryption, the preipl thinks the data is now a decrypted ipl block. | |||
So note the first 0x10 bytes: | So note the first 0x10 bytes: | ||
< | <source lang="xml"> | ||
0x00000000 (load address which was faked to four 0's when decrypted) | 0x00000000 (load address which was faked to four 0's when decrypted) | ||
0x00000000 (size of the block to load, none) | 0x00000000 (size of the block to load, none) | ||
0xBFD00100 (the entry address, the most important part, where your unsigned code is located) | 0xBFD00100 (the entry address, the most important part, where your unsigned code is located) | ||
0x00000000 (checksum) | 0x00000000 (checksum) | ||
</ | </source> | ||
It passes the checksum test (with 0x00000000), it skips the loading of any data (since the loadaddr has been faked to 0x00000000), see's the entry address of 0xBFD00100 and thinks it has reached the end of the ipl and so goes jumps to that address (which is where your unsigned code will be). | |||
So that's essentially it in a nutshell. But dont let a quick 5 min. summary of the exploit underestimate the enormous effort involved in bringing it to fruition (as the final product known as Pandora). | |||
= Properly encrypted Pandora compatible IPL blocks = | |||
On March 10th 2018, Developer Mathieulh released properly encrypted Pandora hack compatible IPL blocks using kirk cmd 0x01 key. | |||
[https://twitter.com/Mathieulh/status/972475508612050944] | |||
[https://twitter.com/Mathieulh/status/972476883802689537] | |||
Here are a few of those: | |||
Retail flagged IPL block with entrypoint set to 0xBFD00100: | |||
< | <source lang="xml"> | ||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
| Line 202: | Line 151: | ||
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
</ | </source> | ||
< | Devkit flagged IPL block with entrypoint set to 0xBFD00100: | ||
<source lang="xml"> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
| Line 225: | Line 175: | ||
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
</ | </source> | ||
< | Devkit flagged IPL block with entrypoint set to 0xBFE01100 (only works on DTP-T1000/DEM-1000!): | ||
<source lang="xml"> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
| Line 248: | Line 199: | ||
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
</ | </source> | ||
< | Retail flagged IPL with entrypoint set to 0xBFE01100 (only works on DTP-T1000/DEM-1000!): | ||
<source lang="xml"> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
| Line 271: | Line 223: | ||
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
</ | </source> | ||
These are available in binary format here: | |||
[https://mega.nz/#F!MlFi1QqZ!fGo2pkCEmjFiPynKtDC0Hg] | |||
The IPL | The 0xBFD00100 version of these blocks work as-is by replacing the time attacked forged block with the properly encrypted ones supplied. The 0xBFE01100 version (which only works on Development Tool units), requires you to rebuild/recompile your custom IPLs using 0xBFE01100 as the entrypoint, it may be wiser to rebuild it as a fully valid IPL instead using ipltool [https://github.com/zecoxao/ipltool],although using the Pandora compatible IPL block instead would allow you to port retail custom IPL projects on devkit with minimal efforts. | ||